CVE-2026-22704

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22704", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-08T19:23:09.857Z", "datePublished": "2026-01-10T06:22:45.076Z", "dateUpdated": "2026-01-13T15:09:03.814Z"}, "containers": {"cna": {"title": "HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778"}, {"name": "https://github.com/haxtheweb/haxcms-nodejs/commit/317a8ae29f88be389f7cfeffaef416957122d97e", "tags": ["x_refsource_MISC"], "url": "https://github.com/haxtheweb/haxcms-nodejs/commit/317a8ae29f88be389f7cfeffaef416957122d97e"}, {"name": "https://github.com/haxtheweb/haxcms-nodejs/releases/tag/v25.0.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/haxtheweb/haxcms-nodejs/releases/tag/v25.0.0"}], "affected": [{"vendor": "haxtheweb", "product": "issues", "versions": [{"version": ">= 11.0.6, < 25.0.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-13T15:09:03.814Z"}, "descriptions": [{"lang": "en", "value": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0."}], "source": {"advisory": "GHSA-3fm2-xfq7-7778", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T13:41:11.957454Z", "id": "CVE-2026-22704", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T13:41:21.317Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22704", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-12T13:41:11.957454Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T13:41:18.414Z"}}], "cna": {"title": "haxcms-php 11.0.6 Stored XSS Leading to Account Takeover", "source": {"advisory": "GHSA-3fm2-xfq7-7778", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "haxtheweb", "product": "issues", "versions": [{"status": "affected", "version": ">= 11.0.6, < 25.0.0"}]}], "references": [{"url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778", "name": "https://github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/haxtheweb/haxcms-nodejs/releases/tag/v25.0.0", "name": "https://github.com/haxtheweb/haxcms-nodejs/releases/tag/v25.0.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-10T06:23:09.987Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22704", "state": "PUBLISHED", "dateUpdated": "2026-01-12T13:41:21.317Z", "dateReserved": "2026-01-08T19:23:09.857Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-10T06:22:45.076Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "issues", "vendor": "haxtheweb", "versions": [{"status": "affected", "version": ">= 11.0.6, < 25.0.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:psu:haxcms-nodejs:11.0.6:*:*:*:*:node.js:*:*", "matchCriteriaId": "EF62173E-0BA7-4937-BBCF-162BA9F775FD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HAX CMS helps manage microsite universe with PHP or NodeJs backends. In versions 11.0.6 to before 25.0.0, HAX CMS is vulnerable to stored XSS, which could lead to account takeover. This issue has been patched in version 25.0.0."}, {"lang": "es", "value": "HAX CMS ayuda a gestionar el universo de micrositios con backends de PHP o NodeJs. En las versiones 11.0.6 hasta antes de la 25.0.0, HAX CMS es vulnerable a XSS almacenado, lo que podr\u00eda llevar a la toma de control de cuentas. Este problema ha sido parcheado en la versi\u00f3n 25.0.0."}], "id": "CVE-2026-22704", "lastModified": "2026-06-17T10:20:15.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22704", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-12T13:41:11.957454Z", "version": "2.0.3"}}]}, "published": "2026-01-10T07:16:03.200", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/haxtheweb/haxcms-nodejs/commit/317a8ae29f88be389f7cfeffaef416957122d97e"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/haxtheweb/haxcms-nodejs/releases/tag/v25.0.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/haxtheweb/issues/security/advisories/GHSA-3fm2-xfq7-7778"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:30:57.383837+00:00", "value": {"mitigation_remediation": ["Upgrade haxcms-nodejs to v25.0.0 or later, as the patch removes the stored XSS vector.", "Redeploy the updated CMS instance to ensure the patch takes effect.", "If an upgrade is not immediately possible, apply input sanitization to all content fields (e.g., using DOMPurify) and enforce a strict Content Security Policy that blocks inline scripts and eval usage."], "summary": {"action": "Immediate Patch", "impact": "Account takeover via Stored XSS"}, "threat_synthesis": {"affected_systems": "The issue affects the haxtheweb haxcms-nodejs product. All installations of version 11.0.6 through 24.x.x are vulnerable; the fix was released in v25.0.0. No other products or versions are indicated as impacted.", "description_and_impact": "HAX CMS versions 11.0.6 up to (but not including) 25.0.0 contain a stored cross-site scripting flaw that allows an attacker to inject malicious script into the CMS database. The injected payload can execute in the context of authenticated users, potentially enabling the theft of user credentials or direct takeover of their administrative accounts. This vulnerability is classified as CWE-79 and provides a direct path from a content author or user with write permissions to an attacker gaining persistent access to privileged sessions.", "risk_and_exploitability": "The CVSS score is 8.1, indicating a high severity. The EPSS score is below 1%, suggesting a low current probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is web-based: an attacker logs into the CMS (or obtains a user account with authoring rights), injects malicious script through a content field, and later an authenticated user views that content, causing the payload to run in their browser. This execution then allows the attacker to hijack the session or exfiltrate information."}}}}, "created": "2026-01-12T14:36:27.950215+00:00", "updated": "2026-04-18T16:45:05.214399+00:00", "vendors": ["haxtheweb", "haxtheweb$PRODUCT$hax"]}